Cart Options

The Cart Options page is used to configure the basic behavior of the cart, and can be found from the menu Store / Cart Options. The options are outlined below.

Cart Options

Storefront Template
The custom markup template to use for the shopping cart Customized Storefront.
Continue Shopping URL
The generic URL for the continue shopping button to link to. This value can be overridden as explained below.
  • If this value is omitted, no continue shopping button will be displayed on the cart page, but upsell functionality will still work.
  • If this field is populated, it is probably a good idea to place a button on the page this refers to in order to provide a path back to the cart without adding another item. The link should simply go to Cart.aspx, and should include the querystring parameters that are noted in “Returning to an Existing Cart”.
    • In this case, it is also required to pass the AuthorID parameter in the querystring so if the customer does not have a cart, the newly created cart will be associated with the proper author and the correct custom HTML will appear.
Maximum Number of Upsells to Display
The maximum number of upsells to display on the cart page.
Shipping Calculation Method
There are 3 shipping calculation methods that can be used on the cart as follows:
  • Combo Price: The prices for each ship option are computed by summing up for each item on the cart as follows:
    • If there is only 1 cart item, the Price field from the Shipping Option is used, otherwise the ComboPrice is used. (ComboPrice is a new field for Shipping Options. Current Shipping Options have been defaulted to use the Price as the ComboPrice)
    • For each shipped item in the cart, the price is then:

      Where:
      • SPi = Shipping Price for the given item
      • P = Price (1 item on cart) or Combo Price (multiple items on cart) from the shipping option
      • Q = Quantity
      • QMP = QMultPrice from the shipping option
    • The total for each option is then the sum of the price computed in the previous bullet point for each cart item, or:
  • Max Plus Half: The price for each option is computed by finding the maximum shipping price for amongst all items on the cart, and summing this with half of the shipping cost for each remaining item on the cart.
    • The ship price for each item is calculated as follows:

      Where:
      • SPi = Shipping Price for the given item
      • P = Price
      • Q = Quantity
      • QMP = QMultPrice from the shipping option
    • The total price for each option is then summed as follows:
  • Max Plus QMult: The price for each option is computed by finding the maximum shipping price amongst all items on the cart, and summing this with the QMultPrice for each remaining item on the cart.
    • The ship price for each item is calculated as follows:

      Where:
      • SPi = Shipping Price for the given item
      • P = Price
      • Q = Quantity
      • QMP = QMultPrice from the shipping option
    • The total price for each option is then summed as follows:
Tax Calculation Method
The method used to calculate tax during checkout. This can be set to the following values:
  • Tax Rules - Uses tax rules defined by country, US State, or Canadian Province. This is the method used by all non European Union authors.
  • European Union VAT - Uses European Union VAT rules. NOTE: Available only for authors within the European Union.
  • Avalara - Uses Avalara AvaTax to calculate tax dynamically. Requires configuring an AvaTax account.

You will also need to set the tax rules through the menu Store / Sales Tax Rules.

Sales Tax Label
Text to override the default label displayed for sales tax in the cart and on invoices.
Country Match Method
Determines whether the shipping and billing country fields are editable during checkout. This can be set to the following values:
  • All - Shipping and billing country must match customer country and the fields are non-editable.
  • Shipping - Shipping country must match customer country and is non-editable. Billing country is editable.
  • Billing - Billing country must match customer country and is non-editable. Shipping country is editable.
  • None - No restrictions - both shipping and billing country are editable.
Require Phone
Whether the phone number is require on the customer registration page.
Disable Priority Codes
Checking this will cause the priority code entry field on the payment page to not be displayed. Checking this will have the same effect as using the NoPrCode=true querystring value outlined above.
Display Images
If this is checked, if the product or product option has an image associated with it, it will be displayed on the cart option detail and view cart pages.
Display Distributor Login
If this is checked, a Distributor/Reseller login option will be displayed on the cart login page to allow Distributors/Resellers to log into the cart using their distributor login information.
Require Source
If this is checked, the free text source (Heard From) field will be a required field during checkout if no marketing sources are defined.
Allow Customer PO
Whether non author/distributor users are allowed to enter a PO number on the payment page during checkout.

Invoice and Mailing Options

Order Confirm HTML
This text is displayed near the top of the order confirmation page and email. The following search and replace variables are supported:
  • [varMerchantDispName] - The merchant account name that will appear on the customer's credit card statement. If no merchant account is associated with the order, the SOLO Server Author's company name will be used.
  • [varPassword] - The customer password. Important Note: We strongly recommended not using this. For customers who have chosen their own password, the value will be masked with * characters and not useful to the user.
  • [varOriginalQS] - Original query string that started order
  • [varChargeAmount] - The total amount charged to the customer's credit card formatted as currency.
  • [varChargeAmountNF] - The total amount charged to the customer's credit card not formatted as currency (to be used with tracking pixels).
  • [varAmountSubtotal] - The subtotal of the order (total minus shipping and taxes) formatted as currency.
  • [varAmountSubtotalNF] - The subtotal of the order (total minus shipping and taxes) not formatted as currency (to be used with tracking pixels).
  • [varInvoiceNo] - The Invoice Number for the order.
  • [varSource] - The order source (entered in the text field on the registration page). The value is HTML-encoded, so use it in page text or in an HTML attribute such as a tracking pixel URL, not inside a script block.
  • [varCustomerID] - The Customer ID.
  • [varEmail] - The Customer Email.
  • [varEmailURLEncoded] - The Customer Email URL Encoded.
  • [varDateEntered] - The date of the order.
  • [varDateEnteredURLEncoded] - The date of the order URL Encoded.
  • [varLicenseID] - The License ID, or a comma-separated list of License IDs (if there are multiple licenses).
Customer Welcome Mailing
The custom mailing to be sent when a new customer registers during checkout. See Customer Welcome Mailings for more details.
Single Order Complete Mailing
The custom mailing to be sent when a single mode cart order is completed and Use Engine Invoice on Single is unchecked. See Customizing Invoices and Order Confirmation Emails and Order Complete Single Order Mode Mailings for more details.
Cart Order Complete Mailing
The custom mailing to be sent when a regular mode cart order is completed. See Customizing Invoices and Order Confirmation Emails and Order Complete Standard Cart Mailings for more details.

Credit Processing Options

These options control how SOLO Server performs credit card fraud verification upon order processing. Note that these fields are only used for Authorize.NET, First Atlantic Commerce, Network Merchants, and PayPal Payments Pro, merchant accounts.

AVS Security Level
Sets up the basic fraud detection feature for Address Verification Service from the credit card bank. Most domestic and some international cards can verify the billing address of the cardholder in real time. International cards which cannot be verified will come back unavailable, which can be accepted or denied. You can choose any of the following options, although options 1 or 2 are most recommended.
  • No AVS checking
  • Zip OR Address Match (Unavailable Allowed) - AVS zip OR address must match, AVS unavailable allowed
  • Zip AND Address Match (Unavailable Allowed) - AVS zip AND address must match, AVS unavailable allowed
  • Zip OR Address Match (Unavailable Disallowed) - AVS zip OR address must match, AVS unavailable rejected
  • Zip AND Address Match (Unavailable Disallowed) - AVS zip AND address must match, AVS unavailable rejected
CVV2 Security Level
Sets up the basic fraud detection feature for CVV2 verification from the credit card bank (Visa/Mastercard only). Most domestic and some international cards can verify the CVV2 number in real time. International cards which cannot be verified will come back unavailable, which can be accepted or denied. You can choose any of the following options, although option 1 is most recommended.
  • No CVV2 checking
  • CVV2 Match (Unavailable Allowed) - CVV2 must match, CVV2 unavailable allowed
  • CVV2 Match (Unavailable Disallowed) - CVV2 must match, CVV2 unavailable rejected
AVS Override
The AVS Security level can be overridden if the CVV2 number matches. The CVV2 number only appears on the back of the card, so the likelihood that this number is guessed is low. You can choose to allow a valid CVV2 number to override the AVS checking or not.
Use Extended Fraud Screening
Whether to use extended fraud screening when processing auth/capture transactions. When enabled, additional fraud checks are performed when processing auth/capture transactions in the shopping cart, with the results included in the author notification email. This is currently in beta and is only available to Master Users.

Bot Challenge (CAPTCHA)

An optional challenge that stops automated card-testing scripts before an order ever reaches your payment gateway. It is off for every account until you switch it on. When enabled, the shopping cart verifies a token from the provider you choose on the credit card and order confirmation pages, records the outcome against the cart, and the payment step refuses any cart that never passed. These settings only apply to the .NET shopping cart.

The challenge covers credit card checkouts that take the card details on your storefront. Stripe and PayPal checkouts are not challenged, because the card is never entered on our side: Stripe collects it on its own hosted page, and PayPal collects it at PayPal. Card testing is the thing this stops, so there is nothing on those routes for it to protect. If Stripe is your only payment method, this setting will not change anything.

Enabling the challenge means customers must have JavaScript enabled to check out, and a small number of real customers on privacy-hardened browsers or shared corporate networks may be asked to complete an extra step. In Enforce mode a customer whose browser never loads the provider's script is declined, so start in Monitor mode and review the counts on your monthly summary before enforcing.

Only the mode is available to every user with access to this page. The provider, the keys and the minimum score are Master User settings: on the SoftwareKey hosted service they are configured by SoftwareKey, and on a self-hosted installation by your master user. Users without master access see which key their account runs with beneath the mode.

If your installation uses customized checkout templates, keep the challenge Off until those templates include the challenge controls and retry messages. Off preserves the existing checkout behavior. Enabling Enforce before the templates are updated can decline customers because their browser cannot supply a challenge token. Customized monthly summary reports may also need an update to display the new counts.

Bot Challenge Mode
  • Off - nothing is rendered or verified. This is the default.
  • Monitor - the challenge runs and the outcome is recorded on the cart, but no order is declined because of it. The failed and unavailable counts on your monthly summary show what Enforce would have declined and how often no verdict was available, so you can judge the effect on real traffic before turning enforcement on.
  • Enforce - a checkout that fails or skips the challenge is declined without contacting the payment gateway. A failed verification is recorded in the Declined Orders report with the reason and the visitor's IP address. A submission that carried no token is declined and counted on the Submitted without a token line of your monthly summary, but is not listed individually in the Declined Orders report, so a flood of them cannot bury the real declines.
Bot Challenge Provider
  • Google reCAPTCHA v3 - the default. Score based. Requires a Google Cloud project. The free tier is 10,000 verifications per month across your whole Google Cloud organization, after which Google stops returning a real verdict until billing is enabled on the project.
  • Cloudflare Turnstile - free with unlimited verifications, no Google account needed, and usually invisible to the customer.
Site Key
The public key from your provider. Register every host name your cart is served from on the key, including your custom URL and the shared URL. Do not register a bare shared domain, which would make the key valid on other storefronts. On the SoftwareKey hosted service you may leave both keys blank to use the SoftwareKey-managed key instead; the page tells you which provider it belongs to.
Secret Key
The private key from your provider, used server side to verify tokens. For Google reCAPTCHA v3, use a score-based website key created in Google Cloud and its legacy secret from Key details, Integration, under Integrate with a third-party service or plugin. A Google Cloud API key is not the legacy secret. See Google's key creation instructions. Keep domain verification enabled and register the host names used by your cart. The secret is stored encrypted and is never displayed again. Leave the field blank when saving to keep the current key; this applies only while the Site Key and provider are unchanged, and a new site key or a different provider must be saved together with its own secret. Clearing the Site Key removes both keys, which returns the account to the installation-managed key where one is configured; on the SoftwareKey hosted service that is the SoftwareKey-managed key.
Service transactions
Every verification sent to the provider is shown on your monthly summary as a service transaction, on a line named BotChallenge. It is not billed and does not count toward the transactions included with your account. Below the transaction totals, a Bot Challenge Outcomes section breaks those verifications down by verdict: Passed, Failed, Expired (the token had already been used or had aged out, and the customer was asked to try again) and Unavailable (the provider could not be reached, the quota was exhausted or the reply could not be used, so the order was allowed through). One verdict is counted per verification, so the four lines and their Total verdicts row add up to the BotChallenge count. A separate line, Submitted without a token, counts checkout posts that carried no usable token and so were never sent to the provider. A submission with no token never reaches the provider, so it appears on the Submitted without a token line rather than as a verification or a verdict; in Enforce mode it is declined, in Monitor mode it proceeds. Each checkout attempt is counted once. The attempts Enforce would decline are therefore Failed plus Submitted without a token, and the second is usually the larger during an attack, because a script posting to the checkout page with no token is counted on every attempt. Those tokenless attempts are counted but are not listed individually in the Declined Orders report, so a flood cannot bury the real declines there.
Minimum Score
Google reCAPTCHA v3 only. A whole number from 0 to 100; scores below it are treated as failed. Google's default is 50. Ignored for Turnstile.

CAPTCHA usage is recorded by the standard counter procedure even when your installation has custom service-usage logging. Existing custom logging parameters and non-CAPTCHA counts are preserved; no custom counter procedure update is required for these three counts. A customized report can omit the counts until its display is updated.

If the provider cannot be reached, or reCAPTCHA reports that your quota is exhausted, the order is allowed to continue, so a provider outage never closes your store silently. Every checkout this happens to is added to the Unavailable line under Bot Challenge Outcomes on your monthly summary, which is the reliable record of how long the condition lasted. An error notification is also emailed to whoever receives error notifications for the installation, which on the SoftwareKey hosted service is SoftwareKey rather than you, and is limited to one an hour per web server so that an outage cannot flood the mailbox. In Enforce mode, the first checkout in an hour that is declined for carrying no token sends a separate notice to the same address. A single notice is normally a script posting to the checkout page directly, but a run of them alongside customer complaints means the provider's browser script is not loading for anyone, which declines every customer of an enforcing account, so the condition is noticed rather than discovered on the monthly summary.

While verification is pending, selecting Previous cancels that attempt and returns to the preceding checkout step. Selecting Continue again does not start a second verification. If an interactive Turnstile challenge expires or remains incomplete for about 30 seconds after the initial wait, the checkout controls become available again so the customer can retry or go back. After the order is submitted, Place Order remains unavailable while the checkout waits for a response.

Styling the challenge through custom markup

The challenge renders below the Previous and Continue buttons on the credit card and confirm order pages, and every part of it can be restyled or repositioned from your storefront template's CSS: